\n"; print __("Click on the Login link above to use your account."); print "
\n"; } } else { # no errors, go ahead and modify the user account $q = "UPDATE Users SET "; $q.= "Username = " . $dbh->quote($U); if ($T) { $q.= ", AccountTypeID = ".intval($T); } if ($S) { /* Ensure suspended users can't keep an active session */ delete_user_sessions($UID); $q.= ", Suspended = 1"; } else { $q.= ", Suspended = 0"; } $q.= ", Email = " . $dbh->quote($E); if ($P) { $salt = generate_salt(); $hash = salted_hash($P, $salt); $q .= ", Passwd = '$hash', Salt = '$salt'"; } $q.= ", RealName = " . $dbh->quote($R); $q.= ", LangPreference = " . $dbh->quote($L); $q.= ", IRCNick = " . $dbh->quote($I); $q.= ", PGPKey = " . $dbh->quote(str_replace(" ", "", $K)); $q.= " WHERE ID = ".intval($UID); $result = $dbh->exec($q); if (!$result) { print __("No changes were made to the account, %s%s%s.", "", htmlspecialchars($U,ENT_QUOTES), ""); } else { print __("The account, %s%s%s, has been successfully modified.", "", htmlspecialchars($U,ENT_QUOTES), ""); } } } return; } /** * Include the search accounts form * * @return void */ function search_accounts_form() { include("search_accounts_form.php"); return; } /** * Display the search results page * * @param string $UTYPE User type of the account accessing the form * @param string $O The offset for the results page * @param string $SB The column to sort the results page by * @param string $U The username search criteria * @param string $T The account type search criteria * @param string $S Whether the account is suspended search criteria * @param string $E The e-mail address search criteria * @param string $R The real name search criteria * @param string $I The IRC nickname search criteria * @param string $K The PGP key fingerprint search criteria * * @return void */ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", $S="",$E="",$R="",$I="",$K="") { $HITS_PER_PAGE = 50; if ($O) { $OFFSET = intval($O); } else { $OFFSET = 0; } if ($OFFSET < 0) { $OFFSET = 0; } $search_vars = array(); $dbh = DB::connect(); $q = "SELECT Users.*, AccountTypes.AccountType "; $q.= "FROM Users, AccountTypes "; $q.= "WHERE AccountTypes.ID = Users.AccountTypeID "; if ($T == "u") { $q.= "AND AccountTypes.ID = 1 "; $search_vars[] = "T"; } elseif ($T == "t") { $q.= "AND AccountTypes.ID = 2 "; $search_vars[] = "T"; } elseif ($T == "d") { $q.= "AND AccountTypes.ID = 3 "; $search_vars[] = "T"; } if ($S) { $q.= "AND Users.Suspended = 1 "; $search_vars[] = "S"; } if ($U) { $U = "%" . addcslashes($U, '%_') . "%"; $q.= "AND Username LIKE " . $dbh->quote($U) . " "; $search_vars[] = "U"; } if ($E) { $E = "%" . addcslashes($E, '%_') . "%"; $q.= "AND Email LIKE " . $dbh->quote($E) . " "; $search_vars[] = "E"; } if ($R) { $R = "%" . addcslashes($R, '%_') . "%"; $q.= "AND RealName LIKE " . $dbh->quote($R) . " "; $search_vars[] = "R"; } if ($I) { $I = "%" . addcslashes($I, '%_') . "%"; $q.= "AND IRCNick LIKE " . $dbh->quote($I) . " "; $search_vars[] = "I"; } if ($K) { $K = "%" . addcslashes(str_replace(" ", "", $K), '%_') . "%"; $q.= "AND PGPKey LIKE " . $dbh->quote($K) . " "; $search_vars[] = "K"; } switch ($SB) { case 't': $q.= "ORDER BY AccountTypeID, Username "; break; case 'r': $q.= "ORDER BY RealName, AccountTypeID "; break; case 'i': $q.= "ORDER BY IRCNick, AccountTypeID "; break; case 'v': $q.= "ORDER BY LastVoted, Username "; break; default: $q.= "ORDER BY Username, AccountTypeID "; break; } $search_vars[] = "SB"; $q.= "LIMIT " . $HITS_PER_PAGE . " OFFSET " . $OFFSET; $dbh = DB::connect(); $result = $dbh->query($q); while ($row = $result->fetch(PDO::FETCH_ASSOC)) { $userinfo[] = $row; } include("account_search_results.php"); return; } /** * Attempt to login and generate a session * * @global int $MAX_SESSIONS_PER_USER Maximum sessions a single user may have open * @global int $PERSISTENT_COOKIE_TIMEOUT Time until cookie expires * * @return array Session ID for user, error message if applicable */ function try_login() { global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT; $login_error = ""; $new_sid = ""; $userID = null; if ( isset($_REQUEST['user']) || isset($_REQUEST['passwd']) ) { $dbh = DB::connect(); $userID = valid_user($_REQUEST['user']); if ( user_suspended($userID) ) { $login_error = "Account Suspended."; } elseif ( $userID && isset($_REQUEST['passwd']) && valid_passwd($userID, $_REQUEST['passwd']) ) { $logged_in = 0; $num_tries = 0; # Account looks good. Generate a SID and store it. while (!$logged_in && $num_tries < 5) { if ($MAX_SESSIONS_PER_USER) { # Delete all user sessions except the # last ($MAX_SESSIONS_PER_USER - 1). $q = "DELETE s.* FROM Sessions s "; $q.= "LEFT JOIN (SELECT SessionID FROM Sessions "; $q.= "WHERE UsersId = " . $userID . " "; $q.= "ORDER BY LastUpdateTS DESC "; $q.= "LIMIT " . ($MAX_SESSIONS_PER_USER - 1) . ") q "; $q.= "ON s.SessionID = q.SessionID "; $q.= "WHERE s.UsersId = " . $userID . " "; $q.= "AND q.SessionID IS NULL;"; $dbh->query($q); } $new_sid = new_sid(); $q = "INSERT INTO Sessions (UsersID, SessionID, LastUpdateTS)" ." VALUES (" . $userID . ", '" . $new_sid . "', UNIX_TIMESTAMP())"; $result = $dbh->exec($q); # Query will fail if $new_sid is not unique if ($result) { $logged_in = 1; break; } $num_tries++; } if ($logged_in) { $q = "UPDATE Users SET LastLogin = UNIX_TIMESTAMP() "; $q.= "WHERE ID = '$userID'"; $dbh->exec($q); # set our SID cookie if (isset($_POST['remember_me']) && $_POST['remember_me'] == "on") { # Set cookies for 30 days. $cookie_time = time() + $PERSISTENT_COOKIE_TIMEOUT; # Set session for 30 days. $q = "UPDATE Sessions SET LastUpdateTS = $cookie_time "; $q.= "WHERE SessionID = '$new_sid'"; $dbh->exec($q); } else $cookie_time = 0; setcookie("AURSID", $new_sid, $cookie_time, "/", null, !empty($_SERVER['HTTPS']), true); header("Location: " . get_uri('/')); $login_error = ""; } else { $login_error = "Error trying to generate session id."; } } else { $login_error = __("Bad username or password."); } } return array('SID' => $new_sid, 'error' => $login_error); } /** * Validate a username against a collection of rules * * The username must be longer or equal to USERNAME_MIN_LEN. It must be shorter * or equal to USERNAME_MAX_LEN. It must start and end with either a letter or * a number. It can contain one period, hypen, or underscore. Returns boolean * of whether name is valid. * * @param string $user Username to validate * * @return bool True if username meets criteria, otherwise false */ function valid_username($user) { if (!empty($user)) { #Is username at not too short or too long? if ( strlen($user) >= USERNAME_MIN_LEN && strlen($user) <= USERNAME_MAX_LEN ) { $user = strtolower($user); # Does username: # start and end with a letter or number # contain only letters and numbers, # and at most has one dash, period, or underscore if ( preg_match("/^[a-z0-9]+[.\-_]?[a-z0-9]+$/", $user) ) { return true; } } } return false; } /** * Determine if a username exists in the database * * @param string $user Username to check in the database * * @return string|void Return user ID if in database, otherwise void */ function valid_user($user) { /* if ( $user = valid_username($user) ) { */ $dbh = DB::connect(); if ( $user ) { $q = "SELECT ID FROM Users "; $q.= "WHERE Username = " . $dbh->quote($user); $result = $dbh->query($q); # Is the username in the database? if ($result) { $row = $result->fetch(PDO::FETCH_NUM); return $row[0]; } } return; } /** * Determine if a user already has a proposal open about themselves * * @param string $user Username to checkout for open proposal * * @return bool True if there is an open proposal about the user, otherwise false */ function open_user_proposals($user) { $dbh = DB::connect(); $q = "SELECT * FROM TU_VoteInfo WHERE User = " . $dbh->quote($user) . " "; $q.= "AND End > UNIX_TIMESTAMP()"; $result = $dbh->query($q); if ($result->fetchColumn()) { return true; } else { return false; } } /** * Add a new Trusted User proposal to the database * * @param string $agenda The agenda of the vote * @param string $user The use the vote is about * @param int $votelength The length of time for the vote to last * @param string $submitteruid The user ID of the individual who submitted the proposal * * @return void */ function add_tu_proposal($agenda, $user, $votelength, $submitteruid) { $dbh = DB::connect(); $q = "INSERT INTO TU_VoteInfo (Agenda, User, Submitted, End, SubmitterID) VALUES "; $q.= "(" . $dbh->quote($agenda) . ", " . $dbh->quote($user) . ", "; $q.= "UNIX_TIMESTAMP(), UNIX_TIMESTAMP() + " . $dbh->quote($votelength); $q.= ", " . $submitteruid . ")"; $result = $dbh->exec($q); } /** * Add a reset key to the database for a specified user * * @param string $resetkey A password reset key to be stored in database * @param string $uid The user ID to store the reset key for * * @return void */ function create_resetkey($resetkey, $uid) { $dbh = DB::connect(); $q = "UPDATE Users "; $q.= "SET ResetKey = '" . $resetkey . "' "; $q.= "WHERE ID = " . $uid; $dbh->exec($q); } /** * Send a reset key to a specific e-mail address * * @param string $email E-mail address of the user resetting their password * @param string $body Body of the email * * @return void */ function send_resetkey($email, $body) { global $AUR_LOCATION; $uid = uid_from_email($email); if ($uid != NULL && $uid != 'None') { # We (ab)use new_sid() to get a random 32 characters long string $resetkey = new_sid(); create_resetkey($resetkey, $uid); # Send email with confirmation link $body = wordwrap($body, 70); $body .= "\n\n". "{$AUR_LOCATION}/" . get_uri('/passreset/') . "?". "resetkey={$resetkey}"; $headers = "Reply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR"; @mail($email, 'AUR Password Reset', $body, $headers); } } /** * Change a user's password in the database if reset key and e-mail are correct * * @param string $hash New MD5 hash of a user's password * @param string $salt New salt for the user's password * @param string $resetkey Code e-mailed to a user to reset a password * @param string $email E-mail address of the user resetting their password * * @return string|void Redirect page if successful, otherwise return error message */ function password_reset($hash, $salt, $resetkey, $email) { $dbh = DB::connect(); $q = "UPDATE Users "; $q.= "SET Passwd = '$hash', "; $q.= "Salt = '$salt', "; $q.= "ResetKey = '' "; $q.= "WHERE ResetKey != '' "; $q.= "AND ResetKey = " . $dbh->quote($resetkey) . " "; $q.= "AND Email = " . $dbh->quote($email); $result = $dbh->exec($q); if (!$result) { $error = __('Invalid e-mail and reset key combination.'); return $error; } else { header('Location: ' . get_uri('/passreset/') . '?step=complete'); exit(); } } /** * Determine if the password is longer than the minimum length * * @param string $passwd The password to check * * @return bool True if longer than minimum length, otherwise false */ function good_passwd($passwd) { if ( strlen($passwd) >= PASSWD_MIN_LEN ) { return true; } return false; } /** * Determine if the password is correct and salt it if it hasn't been already * * @param string $userID The user ID to check the password against * @param string $passwd The password the visitor sent * * @return bool True if password was correct and properly salted, otherwise false */ function valid_passwd($userID, $passwd) { $dbh = DB::connect(); if ( strlen($passwd) > 0 ) { # get salt for this user $salt = get_salt($userID); if ($salt) { # use salt $q = "SELECT ID FROM Users "; $q.= "WHERE ID = " . $userID . " "; $q.= "AND Passwd = " . $dbh->quote(salted_hash($passwd, $salt)); $result = $dbh->query($q); if ($result) { $row = $result->fetch(PDO::FETCH_NUM); if ($row[0]) { return true; } } } else { # check without salt $q = "SELECT ID FROM Users "; $q.= "WHERE ID = " . $userID . " "; $q.= "AND Passwd = " . $dbh->quote(md5($passwd)); $result = $dbh->query($q); if ($result) { $row = $result->fetch(PDO::FETCH_NUM); if ($row[0]) { # password correct, but salt it first if (!save_salt($userID, $passwd)) { trigger_error("Unable to salt user's password;" . " ID " . $userID, E_USER_WARNING); return false; } return true; } } } } return false; } /** * Determine if the PGP key fingerprint is valid (must be 40 hexadecimal digits) * * @param string $fingerprint PGP fingerprint to check if valid * * @return bool True if the fingerprint is 40 hexadecimal digits, otherwise false */ function valid_pgp_fingerprint($fingerprint) { $fingerprint = str_replace(" ", "", $fingerprint); return (strlen($fingerprint) == 40 && ctype_xdigit($fingerprint)); } /** * Determine if the user account has been suspended * * @param string $id The ID of user to check if suspended * * @return bool True if the user is suspended, otherwise false */ function user_suspended($id) { $dbh = DB::connect(); if (!$id) { return false; } $q = "SELECT Suspended FROM Users WHERE ID = " . $id; $result = $dbh->query($q); if ($result) { $row = $result->fetch(PDO::FETCH_NUM); if ($row[0]) { return true; } } return false; } /** * Delete a specified user account from the database * * @param int $id The user ID of the account to be deleted * * @return void */ function user_delete($id) { $dbh = DB::connect(); $q = "DELETE FROM Users WHERE ID = " . $id; $dbh->query($q); return; } /** * Determine if a user is either a Trusted User or Developer * * @param string $id The ID of the user to check if privileged * * @return int|string Return 0 if un-privileged, "2" if Trusted User, "3" if Developer */ function user_is_privileged($id) { $dbh = DB::connect(); $q = "SELECT AccountTypeID FROM Users WHERE ID = " . $id; $result = $dbh->query($q); if ($result) { $row = $result->fetch(PDO::FETCH_NUM); if($row[0] > 1) { return $row[0]; } } return 0; } /** * Remove the session from the database on logout * * @param string $sid User's session ID * * @return void */ function delete_session_id($sid) { $dbh = DB::connect(); $q = "DELETE FROM Sessions WHERE SessionID = " . $dbh->quote($sid); $dbh->query($q); } /** * Remove all sessions belonging to a particular user * * @param int $uid ID of user to remove all sessions for * * @return void */ function delete_user_sessions($uid) { $dbh = DB::connect(); $q = "DELETE FROM Sessions WHERE UsersID = " . intval($uid); $dbh->exec($q); } /** * Remove sessions from the database that have exceed the timeout * * @global int $LOGIN_TIMEOUT Time until session expires * * @return void */ function clear_expired_sessions() { global $LOGIN_TIMEOUT; $dbh = DB::connect(); $q = "DELETE FROM Sessions WHERE LastUpdateTS < (UNIX_TIMESTAMP() - $LOGIN_TIMEOUT)"; $dbh->query($q); return; } /** * Get account details for a specific user * * @param string $uid The User ID of account to get information for * @param string $username The username of the account to get for * * @return array Account details for the specified user */ function account_details($uid, $username) { $dbh = DB::connect(); $q = "SELECT Users.*, AccountTypes.AccountType "; $q.= "FROM Users, AccountTypes "; $q.= "WHERE AccountTypes.ID = Users.AccountTypeID "; if (!empty($uid)) { $q.= "AND Users.ID = ".intval($uid); } else { $q.= "AND Users.Username = " . $dbh->quote($username); } $result = $dbh->query($q); if ($result) { $row = $result->fetch(PDO::FETCH_ASSOC); } return $row; } /** * Determine if a user has already voted on a specific proposal * * @param string $voteid The ID of the Trusted User proposal * @param string $uid The ID to check if the user already voted * * @return bool True if the user has already voted, otherwise false */ function tu_voted($voteid, $uid) { $dbh = DB::connect(); $q = "SELECT COUNT(*) FROM TU_Votes "; $q.= "WHERE VoteID = " . intval($voteid) . " AND UserID = " . intval($uid); $result = $dbh->query($q); if ($result->fetchColumn() > 0) { return true; } else { return false; } } /** * Get all current Trusted User proposals from the database * * @param string $order Ascending or descending order for the proposal listing * * @return array The details for all current Trusted User proposals */ function current_proposal_list($order) { $dbh = DB::connect(); $q = "SELECT * FROM TU_VoteInfo WHERE End > " . time() . " ORDER BY Submitted " . $order; $result = $dbh->query($q); $details = array(); while ($row = $result->fetch(PDO::FETCH_ASSOC)) { $details[] = $row; } return $details; } /** * Get a subset of all past Trusted User proposals from the database * * @param string $order Ascending or descending order for the proposal listing * @param string $lim The number of proposals to list with the offset * * @return array The details for the subset of past Trusted User proposals */ function past_proposal_list($order, $lim) { $dbh = DB::connect(); $q = "SELECT * FROM TU_VoteInfo WHERE End < " . time() . " ORDER BY Submitted " . $order . $lim; $result = $dbh->query($q); $details = array(); while ($row = $result->fetch(PDO::FETCH_ASSOC)) { $details[] = $row; } return $details; } /** * Determine the total number of Trusted User proposals * * @return string The total number of Trusted User proposals */ function proposal_count() { $dbh = DB::connect(); $q = "SELECT COUNT(*) FROM TU_VoteInfo"; $result = $dbh->query($q); $row = $result->fetch(PDO::FETCH_NUM); return $row[0]; } /** * Get all details related to a specific vote from the database * * @param string $voteid The ID of the Trusted User proposal * * @return array All stored details for a specific vote */ function vote_details($voteid) { $dbh = DB::connect(); $q = "SELECT * FROM TU_VoteInfo "; $q.= "WHERE ID = " . intval($voteid); $result = $dbh->query($q); $row = $result->fetch(PDO::FETCH_ASSOC); return $row; } /** * Get an alphabetical list of users who voted for a proposal with HTML links * * @param string $voteid The ID of the Trusted User proposal * * @return array All users who voted for a specific proposal */ function voter_list($voteid) { $dbh = DB::connect(); $whovoted = array(); $q = "SELECT tv.UserID,U.Username "; $q.= "FROM TU_Votes tv, Users U "; $q.= "WHERE tv.VoteID = " . intval($voteid); $q.= " AND tv.UserID = U.ID "; $q.= "ORDER BY Username"; $result = $dbh->query($q); if ($result) { while ($row = $result->fetch(PDO::FETCH_ASSOC)) { $whovoted[] = $row['Username']; } } return $whovoted; } /** * Cast a vote for a specific user proposal * * @param string $voteid The ID of the proposal being voted on * @param string $uid The user ID of the individual voting * @param string $vote Vote position, either "Yes", "No", or "Abstain" * @param int $newtotal The total number of votes after the user has voted * * @return void */ function cast_proposal_vote($voteid, $uid, $vote, $newtotal) { $dbh = DB::connect(); $q = "UPDATE TU_VoteInfo SET " . $vote . " = (" . $newtotal . ") WHERE ID = " . $voteid; $result = $dbh->exec($q); $q = "INSERT INTO TU_Votes (VoteID, UserID) VALUES (" . intval($voteid) . ", " . intval($uid) . ")"; $result = $dbh->exec($q); } /** * Verify a user has the proper permissions to edit an account * * @param string $atype Account type of the editing user * @param array $acctinfo User account information for edited account * @param int $uid User ID of the editing user * * @return bool True if permission to edit the account, otherwise false */ function can_edit_account($atype, $acctinfo, $uid) { /* Developers can edit any account */ if ($atype == 'Developer') { return true; } /* Trusted Users can edit all accounts except Developer accounts */ if ($atype == 'Trusted User' && $acctinfo['AccountType'] != 'Developer') { return true; } /* Users can edit only their own account */ if ($acctinfo['ID'] == $uid) { return true; } return false; }